基于仿生学原理的恶意代码判定与防护模型研究

With the continuous deep-going of China's informationalization , information security is increasingly in grim situation. One of the main threats faced by information security is malicious code. And its determination and defense approach has been the focus of various security research teams. However, existing methods have several weakpoints, such as the difficulty to effectively identify emerging malicious code, security professionals require manual intervention , the threat of malicious code is not timely responded etc. This topic learns bionics in cognitive theory, immune theory and autonomic nervous theory to explore the application of principles of bionics in the field of malicious code determination and defense applications. The main research topics consist three aspects: First, the determination of malicious code based on cognitive theory. With excavation code behavior in depth to determine the nature of emerging malicious code accurately. Second, the optimal matching of defense strategy based on the theory of immunity to make the the choice of defense strategy effectively against malicious code without human intervention. Third, malicious code determination and defense model based on the autonomic nervous. With the applications of adaptive strategies the model could respond to malicious code threats timely. By studying this topic , we could improve the intelligence, automation, integration degree of malicious code determination and defense, and guarantee the accuracy of determining and the validity and timeliness of malicious code defense.

随着我国信息化建设的持续深入，信息安全形势日益严峻，恶意代码作为信息安全面临的主要威胁之一，其判定与防御方法一直是各安全团队的研究重点。但是现有方法存在对于新兴恶意代码难以有效识别，需要安全专业人员的人工介入，对恶意代码威胁响应不及时等问题。本课题借鉴仿生学原理中的认知理论、免疫理论以及自主神经理论，探索仿生学原理在恶意代码判定与防御领域的应用，课题主要研究三方面的问题：一是基于认知理论的恶意代码判定，深度挖掘代码行为，准确判定新兴代码恶意性；二是基于免疫理论的恶意代码防御策略最优匹配，在无需人工介入的情况下选择能够有效对抗恶意代码的防御策略；三是基于自主神经系统的恶意代码判定与防御模型，对防御策略加以自适应应用，及时响应恶意代码威胁。通过本课题的研究，能够提高恶意代码判定与防御的智能化、自动化、一体化程度，进而保证恶意代码判定的准确性，防御的有效性、及时性。

本课题基于仿生学原理，重点围绕恶意代码的检测、防御、相似性分析和基准测试集构建展开研究。本课题提出了软件基因理论，并探索其在恶意代码检测判定及漏洞挖掘方面的应用。针对现有公开的数据集往往无法匹配恶意代码的发展速度，且部分数据集的采集覆盖率较低的问题，本课题提出了一种基于生物遗传算法的自动化的恶意代码基准测试集生成框架，实现了从大规模的原始数据集到具有代表性的基准测试集的生成。本课题研发了一套面向恶意代码分析的二进制软件逆向系统，并提出多种恶意代码检测识别算法，用于检测恶意代码心跳行为、识别定位恶意代码的汇编级行为，实现了恶意代码的分类和威胁性评估和沙箱规避行为的检测。本课题首次提出与平台无关的归约指令依赖关系图，并将其运用于程序相似性度量，实现了跨平台通用的程序相似性度量，不仅能应对主流的代码混淆算法，同时能对程序的内部进行相似性度量。本课题研究借鉴生物界的拟态现象，借助软件多样化编译实现系统异构性，降低网络空间中软件漏洞和后门的威胁。